OfficeLoggingLiblet

25 events across 1 channel

Event	Title	Channel
100	etwtaskLogging	General Logging
101	etwtaskLogging101	General Logging
102	etwtaskLogging102	General Logging
103	etwtaskLogging103	General Logging
104	etwtaskLogging104	General Logging
105	Mso Logging Scope start event.	General Logging
106	Mso Logging Scope short stop event.	General Logging
107	Mso Logging Scope long stop event.	General Logging
108	Mso Scenario start event.	General Logging
109	Mso Scenario short stop event.	General Logging
110	Mso Scenario long stop event.	General Logging
200	ResouceUsagetask	General Logging
201	ResouceUsagetask201	General Logging
202	ResouceUsagetask202	General Logging
1000	ResouceUsagetask1000	General Logging
1001	ResouceUsagetask1001	General Logging
1002	ResouceUsagetask1002	General Logging
1003	ResouceUsagetask1003	General Logging
1004	ResouceUsagetask1004	General Logging
1005	ResouceUsagetask1005	General Logging
1006	ResouceUsagetask1006	General Logging
1007	ResouceUsagetask1007	General Logging
1008	ResouceUsagetask1008	General Logging
1009	ResouceUsagetask1009	General Logging
1010	ResouceUsagetask1010	General Logging

Event ID 100: etwtaskLogging

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Error
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "100",
    "version": "0",
    "level": "2",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:43:16.343398800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "",
    "wzCategory": "Experiment Liblet",
    "wzTag": "9lvor",
    "wzMessage": "OptGates GetValue > Caller queried gate before Mso20 is initialized or after Mso20 is uninitialized. Returning default value. Fix the caller. {\"TeamEnum\": 61, \"FeatureName\": \"ChangeGate.9790726.CastGuardEnforcement\"}"
  },
  "message": ""
}

Event ID 101: etwtaskLogging101

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Warning
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "101",
    "version": "0",
    "level": "3",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:43:17.012542500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "Microsoft Word",
    "wzCategory": "Licensing client liblet",
    "wzTag": "cmo2w",
    "wzMessage": "NULDataProvider::RefreshData - No best license available"
  },
  "message": ""
}

Event ID 102: etwtaskLogging102

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "102",
    "version": "0",
    "level": "4",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:43:16.743491400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "",
    "wzCategory": "Activity",
    "wzTag": "bjtct",
    "wzMessage": "ActivityStarted {\"Name\": \"Office.Performance.Boot\", \"CV\": \"VkHAh2AShk+MQ/PwqFHUOg.1\"}"
  },
  "message": ""
}

Event ID 103: etwtaskLogging103

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Verbose
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "103",
    "version": "0",
    "level": "5",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:41:53.990674000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7864",
      "thread_id": "9352"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "",
    "wzCategory": "Click-To-Run",
    "wzTag": "arqlf",
    "wzMessage": "ServiceStartupBehavior::ServiceMain - Notifying timer listener"
  },
  "message": ""
}

Event ID 104: etwtaskLogging104

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "104",
    "version": "0",
    "level": "16",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:43:17.440814700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "Microsoft Word",
    "wzCategory": "Privacy Options and Consent Providers",
    "wzTag": "c773e",
    "wzMessage": "Constructing IdBasedPrivacyConsentProvider"
  },
  "message": ""
}

Event ID 105: Mso Logging Scope start event.

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Start

Message #

Mso Logging Scope start event

Fields #

Name	Description
`EventData`

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "105",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "1",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-14T21:43:17.632691400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{950a4155-008f-4925-9ba1-670c18121265}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventData": ""
  },
  "message": ""
}

Event ID 106: Mso Logging Scope short stop event.

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Stop

Message #

Mso Logging Scope short stop event

Fields #

Name	Description
`EventData`

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "106",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "2",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-14T21:43:17.633141100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{950a4155-008f-4925-9ba1-670c18121265}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventData": ""
  },
  "message": ""
}

Event ID 107: Mso Logging Scope long stop event.

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Mso Logging Scope long stop Opcode

Message #

Mso Logging Scope long stop event

Fields #

Name	Description
`EventData`

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "107",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "10",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-14T21:43:17.633186400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventData": ""
  },
  "message": ""
}

Event ID 108: Mso Scenario start event.

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Start

Message #

Mso Scenario start event

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`lpScenarioName` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "108",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "1",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwInstanceId": "0",
    "lpScenarioName": ""
  },
  "message": ""
}

Event ID 109: Mso Scenario short stop event.

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Stop

Message #

Mso Scenario short stop event

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "109",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "2",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwInstanceId": "0"
  },
  "message": ""
}

Event ID 110: Mso Scenario long stop event.

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Mso Logging Scope long stop Opcode

Message #

Mso Scenario long stop event

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`bWasSuccessful` Boolean → boolean
`bWasErrorCodeSet` Boolean → boolean
`ErrorCode` Int32 → int

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "110",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "10",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwInstanceId": "0",
    "bWasSuccessful": "false",
    "bWasErrorCodeSet": "false",
    "ErrorCode": "0"
  },
  "message": ""
}

Event ID 200: ResouceUsagetask

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`FilesCreated` Int64 → long
`NumberOfFileReads` Int64 → long
`TotalBytesRead` Int64 → long
`NumberOfFileWrites` Int64 → long
`TotalBytesWritten` Int64 → long
`NumberOfSetEndOfFiles` Int64 → long
`NumberOfSeeks` Int64 → long
`NumberOfLocks` Int64 → long
`NumberOfUnlocks` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "200",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-14T22:55:14.544627000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "2584",
      "thread_id": "10100"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": " 5789059",
    "dwInstanceId": "    3716",
    "FilesCreated": "2",
    "NumberOfFileReads": "0",
    "TotalBytesRead": "0",
    "NumberOfFileWrites": "4",
    "TotalBytesWritten": "4322",
    "NumberOfSetEndOfFiles": "4",
    "NumberOfSeeks": "17",
    "NumberOfLocks": "0",
    "NumberOfUnlocks": "0"
  },
  "message": ""
}

Event ID 201: ResouceUsagetask201

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`Requests` Int64 → long
`BytesSent` Int64 → long
`ElapsedMilliseconds` Int64 → long
`BytesReceived` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "201",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854776832,
    "time_created": "2026-03-14T22:50:51.511474700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": " 5646235",
    "dwInstanceId": "     193",
    "Requests": "1",
    "BytesSent": "0",
    "ElapsedMilliseconds": "180",
    "BytesReceived": "0"
  },
  "message": ""
}

Event ID 202: ResouceUsagetask202

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: Informational
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`BytesUsedDelta` Int64 → long
`BytesUsedAtComplete` UInt64 → unsignedLong

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "202",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854779904,
    "time_created": "2026-03-14T21:43:17.633158800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "19255818",
    "dwInstanceId": "       2",
    "BytesUsedDelta": "81920",
    "BytesUsedAtComplete": "66998272"
  },
  "message": ""
}

Event ID 1000: ResouceUsagetask1000

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ResourceScopePtr` Pointer → HexInt64
`FileUsagePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1000",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:55:03.844782400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "2584",
      "thread_id": "9480"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": " 5646235",
    "InstanceId": "      42",
    "ResourceScopePtr": "0x229426F1428",
    "FileUsagePtr": "0x22945D37340"
  },
  "message": ""
}

Event ID 1001: ResouceUsagetask1001

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ScopePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "1001",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": "0",
    "InstanceId": "0",
    "ScopePtr": "0x0"
  },
  "message": ""
}

Event ID 1002: ResouceUsagetask1002

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ResourceScopePtr` Pointer → HexInt64
`NetworkUsagePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1002",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.509455800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": " 5646235",
    "InstanceId": "     193",
    "ResourceScopePtr": "0x23713C3CE58",
    "NetworkUsagePtr": "0x2370FDCD160"
  },
  "message": ""
}

Event ID 1003: ResouceUsagetask1003

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`ChildScopePtr` Pointer → HexInt64
`ParentScopePtr` Pointer → HexInt64
`TypeOfData` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1003",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.511503000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ChildScopePtr": "0x2370FDCD160",
    "ParentScopePtr": "0x2370FDCC9B0",
    "TypeOfData": "Network"
  },
  "message": ""
}

Event ID 1004: ResouceUsagetask1004

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Result` Boolean → boolean
`StartCounter` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1004",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T21:43:17.549720000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9176"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Result": "true",
    "StartCounter": "356204661992"
  },
  "message": ""
}

Event ID 1005: ResouceUsagetask1005

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Result` Boolean → boolean
`StartCounter` Int64 → long
`StopCounter` Int64 → long
`ElapsedCounters` Int64 → long
`ElapsedMilliseconds` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1005",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.509458700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Result": "true",
    "StartCounter": "396742446362",
    "StopCounter": "396744247464",
    "ElapsedCounters": "1801102",
    "ElapsedMilliseconds": "180"
  },
  "message": ""
}

Event ID 1006: ResouceUsagetask1006

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Result` Boolean → boolean
`Frequency` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1006",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.509457300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Result": "true",
    "Frequency": "10000000"
  },
  "message": ""
}

Event ID 1007: ResouceUsagetask1007

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`FunctionName` UnicodeString → string
`CurrentResourcePrt` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1007",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.509450700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FunctionName": "Mso::Http::Details::ResourceUsageNetworkMonitorTemplate<class Mso::Http::Details::NetworkUsageProductionBase>::ReportResponseReceived",
    "CurrentResourcePrt": "0x23713C3CE50"
  },
  "message": ""
}

Event ID 1008: ResouceUsagetask1008

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ScopePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "1008",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": "0",
    "InstanceId": "0",
    "ScopePtr": "0x0"
  },
  "message": ""
}

Event ID 1009: ResouceUsagetask1009

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ResourceScopePtr` Pointer → HexInt64
`MemoryUsagePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1009",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T21:43:17.632671200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": "19255818",
    "InstanceId": "       2",
    "ResourceScopePtr": "0x1FF3A501078",
    "MemoryUsagePtr": "0x1FF3A7E4B70"
  },
  "message": ""
}

Event ID 1010: ResouceUsagetask1010

Provider: OfficeLoggingLiblet
Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ScopePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "1010",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": "0",
    "InstanceId": "0",
    "ScopePtr": "0x0"
  },
  "message": ""
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID f50d9315-e17e-43c1-8370-3edf6cc057be

Defined in Program, which carries the event manifest.

Observed on:

Win11-26200.6584 · schema read from the registered manifest · binary version 16.0.17726.20016 · captured 2026-06-02

Downloads

OfficeLoggingLiblet registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)